This IP address has been reported a total of
19
times from
15 distinct
sources.
109.133.154.19 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
Germany
with 9
reports;
United Kingdom of Great Britain and Northern Ireland
with 2
reports;
New Zealand
with 2
reports.
The most common categories in these recent reports were:
Web App Attack
16
times;
Brute-Force
8
times;
Hacking
5
times;
Bad Web Bot
3
times;
SSH
1
time;
Other
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show moreTriggered Cloudflare WAF (firewallCustom) from BE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (POST method)
Endpoint: /xmlrpc.php
UA: Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/87.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
[SatOct0320:57:23.7580322026][security2:error][pid4116615:tid4116775][client109.133.154.19:0]ModSecu ...
show more[SatOct0320:57:23.7580322026][security2:error][pid4116615:tid4116775][client109.133.154.19:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"lacer.ch\"][uri\"/xmlrpc.php\"][unique_id\"asFQE0DPAv4O6QUp7WaFbwAAARI\"]
show less
[SatSep2620:43:43.7413712026][security2:error][pid1105816:tid1105883][client109.133.154.19:0]ModSecu ...
show more[SatSep2620:43:43.7413712026][security2:error][pid1105816:tid1105883][client109.133.154.19:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"714\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"4-server.com\"][uri\"/xmlrpc.php\"][unique_id\"argSX2wTYoFB3dWHR16K3wAAAEI\"]
show less
This address sent web requests that have no legitimate reading: known exploit paths, path traversal, ...
show moreThis address sent web requests that have no legitimate reading: known exploit paths, path traversal, injected payloads, or the signature of a vulnerability scanner. This is an attack on the sites we host, blocked on sight. Please check the machine behind it for an attack tool or malware. | method: GET | path: /wp-json/wp/v2/users | 2026-09-26 18:42 UTC
show less
